# What is an initial access broker?

An initial access broker is a criminal who breaks into companies and sells that access to others instead of using it: VPN logins, remote desktop credentials, a web shell on a server or control of an infected laptop. Ransomware groups and other criminals buy such access on criminal markets and start their attack from there, sometimes weeks later. For a victim this has two consequences. The first intrusion may be quiet and look unrelated to the later damage, and the attacker who encrypts may not be the one who got in. And the time between access and attack is an opportunity: accounts used from unusual places, a new remote-access tool or a server calling an outside address can be found before the buyer arrives. NetSenX flags the beaconing and new sessions that such access tends to produce, on every plan; identity logs show the logins.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-an-initial-access-broker

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is a web shell?](https://netsenx.com/en/faq/what-is-a-web-shell)
- [What is protocol tunnelling?](https://netsenx.com/en/faq/what-is-protocol-tunnelling)
- [Why do attackers use legitimate remote-access tools?](https://netsenx.com/en/faq/why-do-attackers-use-legitimate-remote-access-tools)
- [What is wiper malware?](https://netsenx.com/en/faq/what-is-wiper-malware)
- [What is cryptojacking, and can we see it on the network?](https://netsenx.com/en/faq/what-is-cryptojacking)